Changelog
What's shipped in StackSage — new detectors, capabilities, and improvements.
Storage & Egress Intelligence
Five new detectors targeting the most common invisible cost leaks in S3 and NAT gateways. All are runnable without CloudWatch — no extra IAM permissions required for the offline checks.
- S3 access logging disabled — flags buckets with no server access logs (prerequisite for confident lifecycle decisions)
- S3 Intelligent-Tiering not configured — flags buckets missing automatic tier movement for variable workloads
- NAT gateway egress cost estimate — quantifies monthly data-processing cost per NAT and cross-references missing VPC endpoints
- DynamoDB VPC Gateway endpoint missing — free fix that eliminates DynamoDB traffic through NAT ($0.045/GB)
- CloudWatch log groups with no metric filters — large log groups stored but never analysed; corroborates retention findings
- NAT idle-gateway detector now active (was imported but previously unhoooked)
Self-Serve pip Install & Free Tier
StackSage goes public on PyPI. Anyone with AWS credentials can run a full cost audit in under five minutes — no Docker, no GitHub Actions required.
- pip install stacksage — single-command install, works with local creds, SSO profiles, or assumed roles
- Free tier — top 50 findings delivered without a license; upgrade unlocks the full audit pack
- stacksage.yml config — per-project exclusions, thresholds, and tag governance rules
- HTML audit report auto-opens in browser with findings, remediation plan, and verification commands
- Telemetry opt-in — anonymous ping on first run (finding count + region count only)
ECS & Fargate Optimization
Architecture-level recommendations for container workloads — migrate EC2-backed ECS to Fargate, and flag non-prod services that qualify for Fargate Spot.
- ECS EC2-backed → Fargate migration opportunities based on service utilization metrics
- Fargate Spot recommendations for non-production services (tag/name heuristic)
- Scanner: full ECS cluster + service inventory including task CPU/memory enrichment
Serverless Architecture Recommendations
Detectors that look beyond right-sizing — recommending serverless migrations where the workload pattern fits.
- EC2 → Lambda + API Gateway migration candidates (CloudWatch CPU heuristic)
- Lambda x86_64 → arm64 (Graviton2) — ~20% compute savings with no code changes in most runtimes
- RDS → Aurora Serverless v2 candidates for spiky CPU workloads
30+ Detectors Across 12 AWS Services
Major coverage expansion — DynamoDB, ElastiCache, CloudFront, Route 53, Lambda memory, and more.
- DynamoDB unused tables (zero read/write for 30+ days)
- Lambda memory overprovisioning (< 30% memory utilization)
- CloudFront zero-traffic distributions
- Route 53 unused hosted zones (zero queries for 90+ days)
- ElastiCache idle clusters
Configuration, Docs Site & GitHub Actions
First customer-facing configuration system and the launch of stacksageai.com/docs.
- stacksage.yml — exclude resources by ID, tag, region, or detector type; customize thresholds
- GitHub Actions integration — run audits on a schedule or on push with zero local setup
- EBS performance over-provisioning (gp3/io1/io2 with CloudWatch metrics)
- Load balancer empty target groups (ALB/NLB with no registered targets)
- Cost guardrails — detect missing AWS Budgets and Cost Anomaly Detection
- Docs site launched at stacksageai.com/docs
Security Posture Checks
Beyond cost — StackSage now surfaces IAM, exposure, and audit-logging gaps alongside waste findings.
- IAM baseline checks (unused roles, overly permissive policies)
- Exposure checks (public S3, unencrypted EBS, unencrypted RDS)
- Audit logging baseline (CloudTrail, CloudWatch, GuardDuty, Security Hub)
- Summary report artifact (summary.md) alongside HTML and CSV
First Working Audit
Core EC2, EBS, RDS, S3, NAT, and EIP waste detection. Docker-based, designed for internal use and early pilots.
- EC2 idle instances (CPU < 5% over 14 days)
- EBS unattached volumes and oversized snapshots
- RDS idle and oversized instances
- S3 lifecycle missing and versioning cost checks
- NAT gateway idle detection and missing VPC S3 endpoint
- HTML report with per-finding remediation commands and estimated savings
Want to request a feature or report a bug?
Open an issue on GitHub →